google

Purpose

Detects Google API keys embedded in arbitrary strings. Google API keys begin with the well-known prefix AIza and are used to authenticate requests to Google Cloud APIs, Maps, Firebase, and other Google services. Leaking these keys in source code or logs can result in unexpected billing and unauthorized access to Google services.

Features

Regex anchored with \b on both ends to avoid matching substrings of longer tokens.
Fixed 35-character suffix using URL-safe base64 characters ([0-9A-Za-z-_]).
Returns confidence 0.9 — the fixed prefix is distinctive but not as unique as AWS or Stripe prefixes.

Usage: Basic Example

import { detect } from '@suaveplan/security-codes/patterns/google';

const matches = detect('GOOGLE_API_KEY=AIzaSyDummyKey12345678901234567890123');
// matches[0].type === 'google-api-key'
// matches[0].confidence === 0.9

Usage: Advanced Example

import { detect } from '@suaveplan/security-codes/patterns/google';

const config = JSON.stringify({ apiKey: 'AIzaSyDummyKey12345678901234567890123' });
const matches = detect(config);
console.log(matches[0].start, matches[0].end);

API Reference

`detect(input: string): SecurityCodeMatch[]`

Scans input for Google API keys.

Parameter	Type	Description
`input`	`string`	The string to scan

Returns an array of SecurityCodeMatch with type: 'google-api-key' and confidence: 0.9.

Implementation Notes

The AIza prefix is used by Google for API keys across many of their services. The trailing character set ([0-9A-Za-z-_]) is the URL-safe base64 alphabet, matching Google's actual key encoding. lastIndex is reset before each scan.

The confidence value of 0.9 is intentionally conservative relative to Stripe or GitHub patterns, because the AIza prefix is shorter and the character set is broad enough that coincidental matches in large documents are plausible. Callers that process Google-specific configuration files may wish to raise minConfidence to 0.95 and accept the small risk of missing an obfuscated key, while callers performing broad log sweeps should leave it at the default to maximise recall. The 35-character suffix length matches the actual key length as observed in Google Cloud Console-issued credentials.

2.3 KiB Raw Blame History